CVE-2025-65672

CVE-2025-65672 classroomio 0.1.13 中的不安全直接对象引用（IDOR）允许未经授权访问课程设置的分享和邀请。 受影响产品：ClassroomIO 受影响版本：0.1.13 发现者：Rivek Raj Tamang（RivuDon），印度锡金 漏洞详情 不安全直接对象引用（IDOR）/ 访问控制失效 概要 ClassroomIO 0.1.13 版本存在一个 IDOR 漏洞，允许学生（非特权用户）访问受限制的课程设置，特别是分享和邀请管理界面。 该缺陷源于对敏感端点的权限检查不足，导致权限提升和未经授权的课程操作。 复现步骤 1. 创建课程（管理员） 2...

CVE-2025-65670

CVE-2025-65670 classroomio 0.1.13 中存在不安全的直接对象引用（IDOR），允许学生通过操纵 URL 中的课程 ID 来访问管理员/教师的敏感端点，导致敏感课程、管理员和学生数据在系统恢复到正常限制状态之前短暂泄露。发现者：Rivek Raj Tamang RivuDon，印度锡金。 受影响产品：ClassroomIO 受影响版本：0.1.13 发现者：Rivek Raj Tamang RivuDon，印度锡金 漏洞详情 不安全的直接对象引用 / 访问控制缺陷 摘要 此漏洞允许学生级别的用户通过直接操纵 URL 中的课程...

CVE-2025-65669

CVE-2025-65669 An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction. Discovered by - Rivek Raj Tamang RivuDon, Sikkim, India...

CVE-2025-65675

CVE-2025-65675 Classroomio LMS 0.1.13 中存在存储型跨站脚本（XSS）漏洞，允许经过身份验证的攻击者通过精心构造的 SVG 个人资料图片执行任意代码。发现者：Rivek Raj Tamang RivuDon，印度锡金。 受影响产品：ClassroomIO 受影响版本：0.1.13 发现者：Rivek Raj Tamang RivuDon，印度锡金 漏洞详情 存储型跨站脚本 摘要 Classroomio LMS 0.1.13 版本存在存储型跨站脚本（XSS）漏洞，应用程序未能对 SVG 个人资料图片上传进行充分过滤。经过身份验证的攻击者可以上传包含嵌入式...

CVE-2025-65676

CVE-2025-65676 Classroomio LMS 0.1.13 中存在存储型跨站脚本（XSS）漏洞，允许经过身份验证的攻击者通过精心构造的 SVG 封面图片执行任意代码。发现者：Rivek Raj Tamang RivuDon，印度锡金邦。 受影响产品：ClassroomIO 受影响版本：0.1.13 发现者：Rivek Raj Tamang RivuDon，印度锡金邦 漏洞详情 存储型跨站脚本 摘要 在 Classroomio LMS 0.1.13 版本中存在一个存储型跨站脚本（XSS）漏洞，应用程序未能对课程封面图片上传进行消毒。经过身份验证的攻击者可以上传包含嵌入式...

CVE-2025-67259

A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthorized course-level information by modifying intercepted API requests. Changing a captured POST request to a GET request against the /rest/v1/course PostgREST...

EUVD-2025-209575

A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthorized course-level information by modifying intercepted API requests. Changing a captured POST request to a GET request against the /rest/v1/course PostgREST...

CVE-2025-67259

A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthorized course-level information by modifying intercepted API requests. Changing a captured POST request to a GET request against the /rest/v1/course PostgREST...

ClassroomIO.com 访问控制错误漏洞

ClassroomIO.com is an educational platform developed by ClassroomIO as open source. Version 0.1.13 of ClassroomIO.com contains a vulnerability related to access control. This vulnerability arises from ineffective access control, allowing low-privilege student users who are authenticated to access...

CVE-2025-67298

An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile...

EUVD-2025-208562

An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile...

ClassroomIO.com 安全漏洞

ClassroomIO.com is an educational platform developed by ClassroomIO as open source. Versions of ClassroomIO.com prior to 0.2.6 contained security vulnerabilities. These vulnerabilities stemmed from defects in the/api/verify and/rest/v1/profile endpoints, which could allow remote attackers to gain...

CVE-2025-67298

An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile...

CVE-2025-67298

An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile...

CVE-2025-67298

An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile...

CVE-2025-65670

An Insecure Direct Object Reference IDOR in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data. The leak occurs momentarily before the system reverts t...

CVE-2025-65672

Insecure Direct Object Reference IDOR in classroomio 0.1.13 allows unauthorized share and invite access to course settings...

CVE-2025-65676

Stored Cross site scripting XSS vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images...

CVE-2025-65675

Stored Cross site scripting XSS vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pictures...

CVE-2025-65669

An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction...